Google Dismantles XCPE Botnet Infecting 1.3M Android TV Boxes

Introduction

Google, working alongside industry partners, has dismantled a massive botnet dubbed XCPE that enslaved more than 1.3 million Android TV set-top boxes. The devices shipped with malicious firmware that silently enrolled them into a residential proxy network, renting out victims' internet connections to anonymous customers for advertising fraud, credential stuffing, and large-scale content scraping. Google's Threat Intelligence Group (GTIG) identified the manufacturer, China-based Videostrong Technology Co., as the source of the pre-installed malware and has taken legal action to seize the command-and-control infrastructure.

The XCPE Botnet Architecture and Monetization

The XCPE malware loaded a backdoor onto each device at first boot, making the device's IP address available to multiple residential proxy services. These services—often marketed as legitimate bandwidth-sharing platforms—allow customers to route traffic through residential IPs to anonymize activity or spoof geolocation. According to GTIG, Videostrong monetized this access by selling it to criminal affiliates who then pushed additional malware modules onto infected boxes.

Residential proxy networks have become a primary vector for unwanted and malicious traffic. The GTIG report highlights their role in account takeover campaigns, click fraud, and mass scraping of web content for AI training datasets. By embedding the proxy software at the factory level, the attackers bypassed user consent and traditional security controls, turning consumer electronics into unwitting participants in a global cybercrime supply chain.

Beyond TV Boxes: IoT Device Compromise

The XCPE malware was not limited to streaming hardware. Researchers found the same code running on Android-based healthcare devices, karaoke machines, and digital signage systems. Experts estimate the takedown will sever the botnet's access to more than 10 million additional compromised IoT products. This breadth underscores a systemic risk: a single compromised manufacturer can poison diverse device categories that share a common Android codebase, extending the attack surface far beyond the original target market.

Residential Proxy Ecosystem and Legal Actions

The GTIG report names several proxy providers whose software development kits were routinely downloaded by XCPE-infected devices:

• AppSalt / Honeygain – owned by Oxylabs (Vilnius, Lithuania), which rebranded as Source in October 2026 after a $130 million investment from Warburg Pincus.
• NetNut – operated by publicly traded Israeli firm Alarum Technologies; the FBI seized hundreds of NetNut domains in July 2026 linked to a separate botnet called Popa.
• Other providers cited include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.

Google's legal action targeted the domains and servers Videostrong used to control the botnet and deliver secondary payloads. The coordinated effort reflects a growing willingness to pursue infrastructure takedowns alongside technical mitigation.

Industry Collaboration and Practical Mitigation

The operation relied heavily on cross-industry cooperation. Startup Synthient, which tracks proxy provider activity, previously exposed the Kimwolf botnet in January 2026, prompting dozens of proxy services to patch vulnerabilities that Kimwolf exploited to spread laterally across local networks. The Motion Picture Association (MPA) later partnered with Synthient to physically acquire and analyze infected devices, including MECOOL-branded boxes from Skyworth Technology that also bundled Videostrong's malware.

For defenders, the incident offers several actionable lessons:

• Monitor egress traffic for connections to known residential proxy endpoints and unusual bandwidth patterns on IoT networks.
• Enforce device attestation and supply-chain verification for any Android-based hardware deployed in corporate or clinical environments.
• Segment IoT devices on isolated VLANs with strict egress filtering to limit lateral movement and data exfiltration.
• Block known malicious domains associated with the proxy services listed in the GTIG report at the DNS and firewall layers.
• Demand firmware transparency from vendors, including signed bootloaders and reproducible builds, to detect pre-installed implants.

Conclusion

The dismantling of XCPE is a significant win, but it also reveals the fragility of the Android IoT ecosystem when manufacturers prioritize monetization over security. As residential proxy networks continue to blur the line between legitimate bandwidth sharing and cybercrime infrastructure, organizations must adopt zero-trust network architectures and automated threat hunting for their expanding IoT fleets. Grivyonx's cloud security and DevSecOps services help teams embed these protections into CI/CD pipelines and runtime environments, ensuring that device integrity is verified from factory to decommission.